🏃 SparkyFitness — 健康追踪CLI
v1.4.0SparkyFitness CLI 一键记录饮食、运动与生物指标，自动生成健康报告，助你量化管理每日健康状态。
0· 178·1 当前·1 累计
by @aronjanosch下载技能包
最后更新
2026/4/20
安全扫描
OpenClaw
可疑
medium confidenceThe skill appears to match its stated fitness/diary purpose, but there are multiple mismatches and omissions in the instructions (different GitHub repos, undocumented tool dependencies like jq) that make the package inconsistent and worth manually verifying before installation.
评估建议
Before installing or using this skill: 1) Verify the correct upstream repository and Homebrew tap — SKILL.md references aronjanosch/sparky-cli while the metadata/homepage points to CodeWithCJ; confirm which repo you trust and inspect its releases/tags. 2) Inspect the sparky binary/source code (or build from source yourself) to see what network endpoints it contacts and where it persists the API key/config. 3) Install missing helper tools referenced in the docs (e.g., jq) only if you need them. 4...详细分析 ▾
ℹ 用途与能力
The declared purpose (SparkyFitness CLI for food, exercise, check-ins) aligns with the single required binary 'sparky' and the CLI commands shown. However, the SKILL.md's install/build instructions reference a different GitHub repo and Homebrew tap (aronjanosch/sparky-cli and aronjanosch/tap) while the skill metadata/homepage points to CodeWithCJ/SparkyFitness. This repo/homepage mismatch is unexpected and should be verified.
⚠ 指令范围
SKILL.md instructs the agent/user to run and configure the sparky CLI and to set a server URL and API key (sparky config set-url / set-key). That behavior is consistent with a self-hosted CLI. But the instructions also use additional tools/commands without declaring them (example: 'sparky -j food diary | jq ...' references jq). The doc also instructs fetching data from online providers (Open Food Facts, Free Exercise DB) — expected for this purpose but implies network I/O and data sent to external services. The SKILL.md does not document where the CLI stores the API key or how it's protected.
ℹ 安装机制
There is no install spec in the registry (instruction-only), which is lowest automated risk. The included install instructions point to GitHub (aronjanosch/sparky-cli) and a Homebrew tap — both are standard hosts, but they are not the same as the declared homepage repo. The mismatch between homepage/source and the install target is an inconsistency that could indicate a stale fork/copy or an error; confirm the correct upstream and review the upstream code before installing.
✓ 凭证需求
The registry declares no required environment variables or credentials. The CLI uses an API key configured via 'sparky config set-key <key>' (so the key is stored in the CLI config rather than passed via environment). This is proportionate to a client for a self-hosted server. There are no unrelated credential requests in the metadata.
✓ 持久化与权限
The skill does not request 'always' privilege and is user-invocable only; autonomous invocation is allowed by default (normal). There is no install action performed by the platform. The SKILL.md suggests using 'sudo mv' when installing manually, which requires elevated local privileges — standard for installing system binaries but something to avoid unless you trust the binary/repo.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.4.02026/3/19
v0.2.8: --barcode lookup, --pick N, food remove command, brand column in search, diary value fixes
● 无害
安装命令
点击复制官方npx clawhub@latest install sparkyfitness
镜像加速npx clawhub@latest install sparkyfitness --registry https://cn.longxiaskill.com